Threat Intelligence and Incident Management CEH Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A security operations center (SOC) analyst is evaluating threat intelligence feeds to support a new threat-hunting program. The analyst needs a feed that provides real-time indicators of compromise (IOCs) from a wide range of global sources, but the organization has a limited budget and cannot afford commercial feeds. Which type of feed should the analyst prioritize?

   • AOpen-source intelligence (OSINT) feeds such as AlienVault OTX and MISP
   • BCommercial threat intelligence feeds from vendors like Recorded Future
   • CGovernment-provided classified threat bulletins
   • DInternal DNS logs and firewall logs
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   After a threat intelligence team delivered a report on a new malware campaign, the SOC team found that the indicators were not relevant to their environment and that the report format was difficult to use. The SOC provides this feedback to the intelligence team. What is the most appropriate next step for the intelligence team?

   • AStop producing reports until the SOC can use them properly.
   • BSend the same report again with a note explaining its value.
   • CIgnore the feedback because the report was based on accurate data.
   • DUse the feedback to adjust the intelligence requirements and reporting format for future reports.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Why is incident management important for an organization?

   • AIt helps minimize the impact of security incidents and restore operations quickly
   • BIt guarantees that no security incident will ever occur
   • CIt is only required for compliance with regulations
   • DIt eliminates the need for security controls
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   What is the primary goal of processing and analyzing raw threat data?

   • ATo share raw data with external partners without any modification
   • BTo transform raw data into actionable intelligence that supports decision-making
   • CTo store data in a secure database for future reference
   • DTo delete irrelevant data to reduce storage costs
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is incident management in the context of organizational security?

   • AThe process of preventing all security incidents from occurring
   • BThe process of documenting incidents for legal purposes only
   • CThe process of outsourcing security monitoring to a third party
   • DThe process of identifying, responding to, and recovering from security incidents
   Reveal Solution Discussion Select an answer first